Simplified instructions for updating an SSL certificate for Tomcat:

Part 1 - Generating the artifacts (.jks, .csr, .cer/.crt)

1. Use Java's keytool -genkey program to generate a new private key and store it in a keystore (.jks file)
1. This is where you'll be asked for the information that your future Certificate Signing Request (CSR) should contain, such as domain name, company name, city, state, etc.
2. Use Java's keytool program to generate a Certificate Signing Request (CSR) referencing the private key created in the previous step.
3. Go to the domain registrar's website to purchase the new SSL certificate from the partnering Certificate Authority (CA) and use their web UI to start the activation process.
4. During the activation process, you'll be asked to paste the contents of the CSR file created in a previous step.  The CA will review this and decide whether or not to issue you an SSL Certificate file (.crt or .cer file).
5. Upon approval, you will be emailed the SSL Certificate file and must upload this to the web server.

Part 2 - Installation

1. Use Java's keytool -import program to import the SSL Certificate file (.crt or .cer file) into the previously created keystore (.jks file)
2. Use Java's keytool -list program to validate the imported certificate
3. Modify Tomcat's server.xml to reference the new keystore (.jks file)
4. Restart Tomcat and use Digicert's SSL Certificate Checker tool to validate the SSL cert from a third party
1. https://www.digicert.com/help/